Geoff Chappell, Software Analyst
This page lists the functions and variables that are newly exported by name from the Windows kernel in the 1809 release for Windows 10. Another function is new to this release but is exported only by ordinal: it is listed among the Ordinal-Only Kernel Exports Added for Version 10.0.
For the table below, documentation status is summarised by colour coding so that more detail can be given as Remarks with less text. (If you read this website with scripts enabled, then hovering the mouse over any coloured text will produce a tooltip that shows why the text is coloured.) Functions that have their own non-trivial documentation are shown with no background colour. Functions that appear to be completely undocumented are highlighted yellow. If a function is documented now but was not documented in the first contemporaneous Device Driver Kit (DDK), Windows Driver Kit (WDK) or Installable File System (IFS) Kit, then it is shaded yellow to retain some of its previous status. Many undocumented functions do at least have C-language declarations in one or another header file from the WDK. These are shaded orange, except for one special case. Some declarations are known only from “minwin” headers that Microsoft published in early editions of the WDK for Windows 10 which seem since to have been withdrawn. These are highlighted orange to indicate that public knowledge even of the declaration is exceptional.
Name | Export History | Documentation History |
---|---|---|
FsRtlAddToTunnelCacheEx | ||
FsRtlFindInTunnelCacheEx | ||
IoClearAdapterCryptoEngineExtension | ||
KeDynamicPartitioningSupported | ||
KePrepareToDispatchVirtualProcessor | x64 only | |
KeReenterRetpolinedCode | x64 only | |
MmLockPreChargedPagedPool | ||
MmObtainChargesToLockPagedPool | ||
MmReturnChargesToLockPagedPool | ||
MmSetGraphicsPtes | before 1903, declared | |
MmUnlockPreChargedPagedPool |
To be clear, for it is unusual, MmSetGraphicsPtes is shown above as currently undocumented, without even a declaration in a WDK header, because that’s how it looks now in 2020 to anyone who doesn’t hunt through intermediate editions of the WDK. The function seems never to have been documented, but a declaration is in the NTIFS.H from the WDK for Windows 10 Version 1809.
Name | Export History | Documentation History |
---|---|---|
PoDirectedDripsClearDeviceFlags | ||
PoDirectedDripsSetDeviceFlags | ||
PoFxCompleteDirectedPowerTransition | discontinued in 1903 | |
PoFxRegisterInternalDevice | discontinued in 1903 | |
PsGetSiloContainerId | ||
PsGetThreadServerSilo | ||
RtlCopyBitMapEx | x64 only | |
RtlIntersectBitMaps | ||
RtlIntersectBitMapsEx | x64 only | |
RtlUnsignedMultiplyHigh | ||
SeAdjustObjectSecurity | ||
SeCheckForCriticalAceRemoval | ||
VfIsRuleClassEnabled | ||
WheaLogInternalEvent | before 2004, undocumented documented start is 2004 |
|
ZwAllocateVirtualMemoryEx |
Six functions cease to be exported from the kernel in version 1809. All were first exported from version 6.3 and would have been undocumented except that declarations were published, possibly by oversight, in early editions of the WDK for Windows 10: